| Status | Autorun name | Command | Description |
| N | SchSvr | SchSvr.exe | WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card, you will need it. Available via Start -> Programs |
| Y | SCHWIZEX | SCHWIZEX.EXE | Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot |
| X | sck121 | helpsyss.exe | Added by a variant of the MAILBOT TROJAN! |
| N | sclauncher | sclauncher.exe | SimpleCenter digital media player/manager that supports the iPod, Sony PSP, Xbox 360, some of the Nokia N-series mobile phones and others |
| X | sclick | sclick.exe | Added by the FAKEALERT TROJAN! |
| X | ScManager | scman.exe | Added by the FORBOT-CW WORM! |
| X | scopedll | scopedll.exe | Added by a variant of the CRYPTER.C TROJAN! |
| N | Scotia OnLine Recovery | etdirrcv.exe | Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process |
| N | Scotia OnLine Security v*.* Recovery | etdirrcv.exe | Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process |
| X | scoupa | sincra.exe | Added by the SDBOT-ST WORM! |
| X | scoupas | [worm filename] | Added by the SDBOT.ALC WORM! The most common filename is "sincras.exe" |
| X | Scr | scr.scr | Added by the OPASERV.T WORM! |
| N | ScrapPad | Scrappad.exe | ScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paper |
| X | scrbmk | [path to trojan] | Added by the DLOADER-VP TROJAN! |
| U | Screen Calendar | scrcal.exe | Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler |
| U | Screen Guard | launch.exe | Part of Access Denied security and privacy software |
| U | Screen Guard Message Scan | sgms.exe | Part of Access Denied security and privacy software |
| X | Screen Saver | scrnsaver.scr | Added by the RBOT-AGP WORM! |
| N | Screen Saver Control | FSScrCtl.exe | Screen saver control applet used by the "Stardust Screen Saver Toolkit", SolidWorks and Hubble Space Telescope screen savers (and possibly others). Lets you control your installed screensavers from a System Tray icon |
| N | ScreenHunter 4.0 Free | ScreenHunter.exe | "ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots" |
| N | ScreenPrint32 | ScreenPrint32.exe | ScreenPrint32 screen capture software - can be launched manually |
| X | ScreenSaverPlus | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| X | ScreenView | ScreenView.exe | ScreenView spyware |
| ? | screxe | scruser2k.exe | ?? |
| ? | script | script.bat | Maybe associated with DOS on a Win9x machine |
| Y | ScriptBlocking | SBServ.exe | Part of the "Script Blocking" feature for older versions of Symantec's Norton AntiVirus which monitors script-based (ie, JavaScript, VB Script) viruses and alerts you of virus-like malicious behavior, stopping these viruses before they can infect your system. Loads via the registry "Run" or "RunServices" keys in 98/Me and as a service in XP |
| Y | ScriptSentry | Scriptsentry.exe | Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly |
| U | Scroll-In-Mouse V2.0 | SCROLL.EXE | Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features |
| X | scroller | fpapli.exe | CoolWebSearch parasite variant |
| X | scrss | scrss.exe | Added by the HACDEF-R TROJAN! |
| X | scrsvc | scrsvc.exe | Added by the AGENT-DS TROJAN! |
| X | ScrSvr | ScrSvr.exe | Added by the OPASERV WORM! |
| X | ScrSvrOld | [worm filename] | Added by the OPASERV WORM! |
| Y | Scsi | Scsi.exe | SCSI Miniport driver |
| X | scssrr.exe | Services.exe | Added by the VB-EMX TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| X | sctrlmgr | sescmgr.exe | Added by a variant of the DWNLDR-GAH TROJAN! |
| Y | SCTUINotify | SCTUINotify.exe | Part of Windows SteadyState, which is designed to make life easier for people who set up and maintain shared computers - enabling the system administrator to prevent users from making changes to the system configuration, windows desktop, restricting program access, etc. It's intended for shared user environments such as internet cafés, libraries and schools but can be used in any environment. This entry displays the timeout messages on the restricted computer/account - which warns users how long they have until automatic log-off when they log-in and when there are only 2 minutes left |
| X | scvhost | svzhost.exe | Added by a variant of the SPYBOT WORM! |
| U | scvhost | scvhost.exe | Wiretap surveillance software. Uninstall this software unless you put it there yourself |
| X | scvhost | scvhost.exe | Added by the AGOBOT-LI WORM! |
| U | scvhost | OverSpy.exe | OverSpy surveillance software. Uninstall this software unless you put it there yourself |
| X | scvhost loader | ixplore.exe | Added by the SDBOT-CY TROJAN! |
| X | scvhost.exe | scvhost.exe | Added by the LOHAV-N TROJAN! |
| X | Scvsrv32 | scvsrv32.exe | Added by the AGOBOT-PM BACKDOOR! |
| X | sd32info | sd32info.exe | Added by the CRYPTER.A TROJAN! |
| U | SDaemon | sdaemon.exe | PC Security™ from Tropical Software - "is the ultimate in computer security, offering multiple locking systems for the windows environment and internet. Lock files, monitor programs activities, even detect intruders!" |
| U | SDAutoLiveupdate | LiveUpdateSD.exe | Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here |
| X | SDAv | csnss.exe | Added by the SERFLOG.C WORM! |
| X | SDAv | svhost.exe | Added by the SERFLOG.C WORM! |
| X | sdchosts32 | vbdd.exe | Added by the RANKY.AG TROJAN! |
| U | SDClientMonitor | sdclientmonitor.exe | LANDesk® Management Suite software component |
| N | SDetect | SDetect.exe | ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button |
| X | sdfgsdfg | hey.exe | Added by the AGOBOT-OR WORM! |
| X | sdfsdfsdf | sp2update.exe | Added by a variant of the SPYBOT WORM! |
| X | sdfwfq | mxxcva.exe | Added by the SDBOT-QN WORM! |
| X | SDIN Adapter | sdin.exe | Added by the FORBOT-AP WORM! |
| ? | SDJobCheck | triggusr.exe | Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup? |
| X | SDK Codre Function22 | sdkimddprovment2.exe | Added by the SDBOT-YJ WORM! |
| X | SDK Core Component | sdkcore.exe | Added by the SDBOT-WC WORM! |
| X | SDK Core Function | sdkimprovment.exe | Added by the RBOT.BHL WORM! |
| X | SDK Core Function2 | sdkimprovment2.exe | Added by the SPYBOT.OGX WORM! |
| X | Sdk**.exe [* = random char] | Sdk**.exe [* = random char] | CoolWebSearch/HomeSearch adware - for examples, see this log |
| X | Sdk**32.exe [* = random char] | Sdk**32.exe [* = random char] | CoolWebSearch/HomeSearch adware - for examples, see this log |
| X | SDKcore Update Components2 | SDKC0R3.exe | Added by the RBOT-ABA WORM! |
| X | SDKCprords | SDKc55rezzz.exe | Added by the RBOT.VD WORM! |
| X | sdkupdate22 | SDK0mCORE.exe | Added by the FORBOT-DT WORM! |
| X | SDKz0r | SDKc55rezzz2.exe | Added by the SDBOT-UN WORM! |
| ? | SDMSSplash | launcher.exe | Part of HP's Smart Desktop Management System - "Preloaded on select business desktops, SDMS features automatic remote backup and disaster recovery via secure offsite storage and helps detect and remove PC security threats." Is this just the "splash" screen shown when the program lauches and is it therefore required? |
| N | SDPhotoBar.exe | SDPhotoBar.exe | SmartDraw Photo (now FotoFinsh) - "organize, enhance, print, and share your photos. It's also a powerful graphic editor for creating images and web graphics" |
| X | SDR6_Check | udcsdr.exe | Part of the DriveCleaner rogue security software - not recommended, removal instructions here |
| X | SDR6V_Check | udcsdr.exe | Part of the DriveCleaner rogue security software - not recommended, removal instructions here |
| X | sdrss | sdrss.exe | Added by the SDBOT-SQ WORM! |
| U | sds20 | svchost.exe | InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\sds20 |
| X | SdScans** | stup_tmp.#32 | Added by the SDSCAN.A TROJAN - where ** are random upper case letters |
| U | SDTray | sdtray.exe | RSA Keon Web PassPort - software that allows organizations to use digital certificates in a Web-based environment to help ensure that their transactions are authentic, confidential and digitally signed |
| Y | SDTray | SDTrayApp.exe | System Tray access to an older version of Spyware Doctor antispyware from PC Tools |
| X | sdxsys32 | sdxsys32.exe | Added by the BROGGER-A TROJAN! |
| N | Seagate 2GHK2Q3E Product Registration | Seagate 2GHK2Q3E Product Registration.exe | LeaderTech's PowerREGISTER registration reminder for Seagate storage products |
| N | Seagate Product Registration | Seagate Product Registration.exe | LeaderTech's PowerREGISTER registration reminder for Seagate storage products |
| U | SeahawksScreenServer | SeahawksScreenServer.exe | Screensaver for the Seattle Seahawks NFL football team - part of Sports Illustrated's MySI desktop download (by MercurySports Network) for streaming information on NFL football teams. No longer supported |
| U | SeahawksScreenServerSvc | SeahawksScreenServer.exe | Screensaver for the Seattle Seahawks NFL football team - part of Sports Illustrated's MySI desktop download (by MercurySports Network) for streaming information on NFL football teams. No longer supported |
| U | sealmon | sealmon.exe | SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint and Email |
| X | Search Bar | taskbar.exe | Added by the OPANKI-F WORM! |
| X | Search Defender | SearchDefender.exe | Installed by SpeedItUp without permission, along with PC-Checker. Detected by DrWeb as the STARTPAGE.ORIGIN TROJAN! |
| ? | Search Hook | srchhook.exe | ?? |
| X | Search Page | http://find.naupoint.com | Naupoint browser hijacker |
| U | Search Protection | SearchProtection.exe | "Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!" |
| X | Search-Exe | SE.exe | Search-Exe hijacker |
| X | SearchAndDestroyMFC | Search And Destroy.exe | Search And Destroy rogue security software - not recommended, removal instructions here |
| X | SearchAndDestroyScheduler | SearchAndDestroy.exe | Search And Destroy rogue security software - not recommended, removal instructions here |
| X | SearchAndDestroyT | SearchAndDestroy.exe | Search And Destroy rogue security software - not recommended, removal instructions here |
| X | searchbar | vnmispoisn downloader.exe | SearchBarCash adware variant |
| X | SearchClick | [trojan filename] | Added by the AGENT-DWR TROJAN! |
| ? | SearchEngineProtection | SearchEngineProtection.exe | Installed with an older version of the Oberon Gamesbar from Oberon Media which is provided to "help fans of casual games have a quick and easy access to all the new games available to play. Part of Internet Explorer, the Gamesbar will keep your games at your fingertips." Powered by Google this probably protected the default search engine used |
| X | SearchEnhancement | scbar.exe | SCBar/SearchEnhancement foistware |
| X | SearchMP3 | rundll32.exe MSA64CHK.dll,DllMostrar | MatrixDialer/Mostrar parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in %System% |
| X | searchnav | searchnav.exe | SearchNav adware - IEFeatures/Popnav variant |
| X | SearchNavVersion | searchnavversion.exe | SearchNav adware - IEFeatures/Popnav variant |
| X | SearchNet_Up | ServeUp.exe | SearchNet adware |
| U | SearchProtection | SearchProtection.exe | "Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!" |